# ALAS2023-2026-3187: Security update for 19 packages ALAS2023-2026-3187, released November 7, 2026, fixes 250 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3187 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-89688, rated Critical) - CVEs: 250, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3187.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel-livepatch-6.18.51-120.162](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.51-120.162.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | | [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.51-120.162.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-89688](https://patchblox.com/security/data/cve/CVE-2026-89688.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on s... | 9.8 | 0.0074 | | | [CVE-2026-90048](https://patchblox.com/security/data/cve/CVE-2026-90048.md) | Urgent | fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() | 9.8 | 0.0072 | | | [CVE-2026-80976](https://patchblox.com/security/data/cve/CVE-2026-80976.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation deca... | 9.8 | 0.0071 | | | [CVE-2026-89485](https://patchblox.com/security/data/cve/CVE-2026-89485.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file loc... | 9.8 | 0.0071 | | | [CVE-2026-89655](https://patchblox.com/security/data/cve/CVE-2026-89655.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf en... | 9.8 | 0.0071 | | | [CVE-2026-89712](https://patchblox.com/security/data/cve/CVE-2026-89712.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropp... | 9.8 | 0.0071 | | | [CVE-2026-89555](https://patchblox.com/security/data/cve/CVE-2026-89555.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_... | 9.8 | 0.0069 | | | [CVE-2026-89634](https://patchblox.com/security/data/cve/CVE-2026-89634.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_dat... | 9.8 | 0.0069 | | | [CVE-2026-89713](https://patchblox.com/security/data/cve/CVE-2026-89713.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock... | 9.1 | 0.0067 | | | [CVE-2026-89636](https://patchblox.com/security/data/cve/CVE-2026-89636.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() W... | 9.8 | 0.0066 | | | [CVE-2026-89536](https://patchblox.com/security/data/cve/CVE-2026-89536.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake... | 9.8 | 0.0064 | | | [CVE-2026-89558](https://patchblox.com/security/data/cve/CVE-2026-89558.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in... | 9.8 | 0.0064 | | | [CVE-2026-89651](https://patchblox.com/security/data/cve/CVE-2026-89651.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode i... | 9.8 | 0.0064 | | | [CVE-2026-90012](https://patchblox.com/security/data/cve/CVE-2026-90012.md) | Urgent | spi: Fix DMA mapping ownership on partial map failure | 9.8 | 0.0063 | | | [CVE-2026-89658](https://patchblox.com/security/data/cve/CVE-2026-89658.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4... | 9.8 | 0.0062 | | | [CVE-2026-89660](https://patchblox.com/security/data/cve/CVE-2026-89660.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin... | 9.8 | 0.0062 | | | [CVE-2026-89703](https://patchblox.com/security/data/cve/CVE-2026-89703.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_... | 9.8 | 0.0062 | | | [CVE-2026-89689](https://patchblox.com/security/data/cve/CVE-2026-89689.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in... | 9.8 | 0.0061 | | | [CVE-2026-89990](https://patchblox.com/security/data/cve/CVE-2026-89990.md) | Urgent | ceph: lock mutex in ceph_mds_check_access() | 9.8 | 0.0061 | | | [CVE-2026-89637](https://patchblox.com/security/data/cve/CVE-2026-89637.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_che... | 9.8 | 0.0060 | | | [CVE-2026-89633](https://patchblox.com/security/data/cve/CVE-2026-89633.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated... | 9.8 | 0.0055 | | | [CVE-2026-89478](https://patchblox.com/security/data/cve/CVE-2026-89478.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed... | 9.8 | 0.0051 | | | [CVE-2026-89541](https://patchblox.com/security/data/cve/CVE-2026-89541.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length check... | 9.8 | 0.0051 | | | [CVE-2026-89542](https://patchblox.com/security/data/cve/CVE-2026-89542.md) | Urgent | SUNRPC: harden gss_krb5_unwrap_v2 against short tokens | 9.8 | 0.0051 | | | [CVE-2026-89551](https://patchblox.com/security/data/cve/CVE-2026-89551.md) | Urgent | SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow | 9.8 | 0.0051 | | | [CVE-2026-89652](https://patchblox.com/security/data/cve/CVE-2026-89652.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS exp... | 9.8 | 0.0051 | | | [CVE-2026-90037](https://patchblox.com/security/data/cve/CVE-2026-90037.md) | Urgent | NFSD: Prevent client use-after-free during close_lru reaping | 9.8 | 0.0051 | | | [CVE-2026-89653](https://patchblox.com/security/data/cve/CVE-2026-89653.md) | Urgent | ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode | 9.8 | 0.0050 | | | [CVE-2026-89702](https://patchblox.com/security/data/cve/CVE-2026-89702.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt... | 9.8 | 0.0050 | | | [CVE-2026-90042](https://patchblox.com/security/data/cve/CVE-2026-90042.md) | Urgent | ceph: properly decrypt filenames in vmalloc() buffers | 9.8 | 0.0050 | | | [CVE-2026-89479](https://patchblox.com/security/data/cve/CVE-2026-89479.md) | Urgent | sctp: stop processing a packet once its association is deleted | 9.8 | 0.0050 | | | [CVE-2026-89676](https://patchblox.com/security/data/cve/CVE-2026-89676.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for as... | 9.8 | 0.0049 | | | [CVE-2026-89631](https://patchblox.com/security/data/cve/CVE-2026-89631.md) | Urgent | smb: client: reject a tree connect response whose byte count is too small | 9.1 | 0.0049 | | | [CVE-2026-90036](https://patchblox.com/security/data/cve/CVE-2026-90036.md) | Urgent | NFSD: Prevent client use-after-free during blocked-lock reaping | 9.8 | 0.0048 | | | [CVE-2026-93207](https://patchblox.com/security/data/cve/CVE-2026-93207.md) | Urgent | SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry | 9.8 | 0.0047 | | | [CVE-2026-89675](https://patchblox.com/security/data/cve/CVE-2026-89675.md) | Urgent | nfsd: fix UAF in async copy cancel and shutdown | 9.8 | 0.0044 | | | [CVE-2026-89775](https://patchblox.com/security/data/cve/CVE-2026-89775.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VN... | 9.3 | 0.0024 | | | [CVE-2026-89914](https://patchblox.com/security/data/cve/CVE-2026-89914.md) | Urgent | KVM: arm64: Sign-extend VA for range-based TLBI invalidation | 9.3 | 0.0019 | | | [CVE-2026-89916](https://patchblox.com/security/data/cve/CVE-2026-89916.md) | Urgent | KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry | 9.3 | 0.0019 | | | [CVE-2026-89918](https://patchblox.com/security/data/cve/CVE-2026-89918.md) | Urgent | KVM: arm64: Correctly handle end of VA space TLBI invalidation | 9.3 | 0.0019 | | | [CVE-2026-90011](https://patchblox.com/security/data/cve/CVE-2026-90011.md) | High | scsi: target: iscsi: Reserve a terminator byte for the login payload | 9.8 | 0.0084 | | | [CVE-2026-89696](https://patchblox.com/security/data/cve/CVE-2026-89696.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH t... | 7.5 | 0.0075 | | | [CVE-2026-89680](https://patchblox.com/security/data/cve/CVE-2026-89680.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file leak on inter-server COPY se... | 7.5 | 0.0074 | | | [CVE-2026-89544](https://patchblox.com/security/data/cve/CVE-2026-89544.md) | High | SUNRPC: fix gssx_dec_option_array error path bugs | 9.8 | 0.0072 | | | [CVE-2026-89679](https://patchblox.com/security/data/cve/CVE-2026-89679.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for... | 7.5 | 0.0072 | | | [CVE-2026-89482](https://patchblox.com/security/data/cve/CVE-2026-89482.md) | High | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | 9.8 | 0.0071 | | | [CVE-2026-89538](https://patchblox.com/security/data/cve/CVE-2026-89538.md) | High | SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field | 9.8 | 0.0071 | | | [CVE-2026-89643](https://patchblox.com/security/data/cve/CVE-2026-89643.md) | High | audit: avoid dropping live tree ref on fsnotify rule autoremove | 9.8 | 0.0071 | | | [CVE-2026-89549](https://patchblox.com/security/data/cve/CVE-2026-89549.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_fo... | 8.1 | 0.0071 | | | [CVE-2026-89476](https://patchblox.com/security/data/cve/CVE-2026-89476.md) | High | sctp: fix stream->outcnt underflow on duplicate RECONF responses | 7.8 | 0.0070 | | | [CVE-2026-89707](https://patchblox.com/security/data/cve/CVE-2026-89707.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error... | 7.5 | 0.0070 | | | [CVE-2026-89662](https://patchblox.com/security/data/cve/CVE-2026-89662.md) | High | NFSD: Prevent lock owner use-after-free during client teardown | 9.8 | 0.0069 | | | [CVE-2026-89669](https://patchblox.com/security/data/cve/CVE-2026-89669.md) | High | nfsd: initialize copy-notify stateid before publishing it | 9.8 | 0.0069 | | | [CVE-2026-89649](https://patchblox.com/security/data/cve/CVE-2026-89649.md) | High | ceph: bound xattr value length in __build_xattrs() | 9.1 | 0.0068 | | | [CVE-2026-89647](https://patchblox.com/security/data/cve/CVE-2026-89647.md) | High | ceph: do not repeat ceph_trim_dentries() if no progress possible | 7.8 | 0.0068 | | | [CVE-2026-89648](https://patchblox.com/security/data/cve/CVE-2026-89648.md) | High | ceph: cap delegated inode count in ceph_parse_deleg_inos() | 7.5 | 0.0068 | | | [CVE-2026-89973](https://patchblox.com/security/data/cve/CVE-2026-89973.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData... | 9.8 | 0.0062 | | | [CVE-2026-89586](https://patchblox.com/security/data/cve/CVE-2026-89586.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes... | 8.2 | 0.0062 | | | [CVE-2026-89657](https://patchblox.com/security/data/cve/CVE-2026-89657.md) | High | libceph: validate OSD extent maps before cursor advance | 7.5 | 0.0061 | | | [CVE-2026-89685](https://patchblox.com/security/data/cve/CVE-2026-89685.md) | High | nfsd: fix clock domain mismatch in clients_still_reclaiming() | 7.5 | 0.0061 | | | [CVE-2026-89692](https://patchblox.com/security/data/cve/CVE-2026-89692.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegatio... | 7.5 | 0.0061 | | | [CVE-2026-89554](https://patchblox.com/security/data/cve/CVE-2026-89554.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie M... | 9.8 | 0.0060 | | | [CVE-2026-89483](https://patchblox.com/security/data/cve/CVE-2026-89483.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup... | 7.5 | 0.0057 | | | [CVE-2026-89547](https://patchblox.com/security/data/cve/CVE-2026-89547.md) | High | SUNRPC: Check svc pool percpu counter allocation | 8.1 | 0.0056 | | | [CVE-2026-89671](https://patchblox.com/security/data/cve/CVE-2026-89671.md) | High | nfsd: gate nfs3 setacl by argp->mask | 9.1 | 0.0055 | | | [CVE-2026-89667](https://patchblox.com/security/data/cve/CVE-2026-89667.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shut... | 8.1 | 0.0054 | | | [CVE-2026-89682](https://patchblox.com/security/data/cve/CVE-2026-89682.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispos... | 8.1 | 0.0053 | | | [CVE-2026-89706](https://patchblox.com/security/data/cve/CVE-2026-89706.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY write... | 8.2 | 0.0053 | | | [CVE-2026-89704](https://patchblox.com/security/data/cve/CVE-2026-89704.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async... | 7.5 | 0.0053 | | | [CVE-2026-81002](https://patchblox.com/security/data/cve/CVE-2026-81002.md) | High | xdp: fix zero-copy frame layout | 9.8 | 0.0051 | | | [CVE-2026-89656](https://patchblox.com/security/data/cve/CVE-2026-89656.md) | High | libceph: reject buckets with mismatched CRUSH ids | 9.8 | 0.0051 | | | [CVE-2026-89650](https://patchblox.com/security/data/cve/CVE-2026-89650.md) | High | ceph: bound num_export_targets array for mds info v2/v3 | 9.1 | 0.0051 | | | [CVE-2026-89684](https://patchblox.com/security/data/cve/CVE-2026-89684.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_sta... | 9.8 | 0.0050 | | | [CVE-2026-89477](https://patchblox.com/security/data/cve/CVE-2026-89477.md) | High | sctp: fix NULL deref on untransmitted RECONF completion | 7.5 | 0.0050 | | | [CVE-2026-89699](https://patchblox.com/security/data/cve/CVE-2026-89699.md) | High | nfsd: validate symlink target length in NFSv4 CREATE | 7.5 | 0.0050 | | | [CVE-2026-89550](https://patchblox.com/security/data/cve/CVE-2026-89550.md) | High | SUNRPC: svcauth_gss: enforce krb5 token minimum length | 9.8 | 0.0049 | | | [CVE-2026-89561](https://patchblox.com/security/data/cve/CVE-2026-89561.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_... | 7.5 | 0.0048 | | | [CVE-2026-89659](https://patchblox.com/security/data/cve/CVE-2026-89659.md) | High | NFSD: Prevent client use-after-free during delegation revoke | 9.8 | 0.0048 | | | [CVE-2026-89663](https://patchblox.com/security/data/cve/CVE-2026-89663.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before droppin... | 9.8 | 0.0046 | | | [CVE-2026-89708](https://patchblox.com/security/data/cve/CVE-2026-89708.md) | High | nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown | 9.8 | 0.0044 | | | [CVE-2026-89711](https://patchblox.com/security/data/cve/CVE-2026-89711.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_... | 8.2 | 0.0044 | | | [CVE-2026-89481](https://patchblox.com/security/data/cve/CVE-2026-89481.md) | High | nvme-tcp: fix host memory disclosure on R2T for a read command | 8.8 | 0.0043 | | | [CVE-2026-89480](https://patchblox.com/security/data/cve/CVE-2026-89480.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few... | 8.8 | 0.0043 | | | [CVE-2026-89616](https://patchblox.com/security/data/cve/CVE-2026-89616.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompre... | 7.5 | 0.0042 | | | [CVE-2026-72493](https://patchblox.com/security/data/cve/CVE-2026-72493.md) | High | net: serialize netif_running() check in enqueue_to_backlog() | 9.9 | 0.0040 | | | [CVE-2026-89995](https://patchblox.com/security/data/cve/CVE-2026-89995.md) | High | dma-direct: return struct page from dma_direct_alloc_from_pool() | 8.8 | 0.0035 | | | [CVE-2026-89897](https://patchblox.com/security/data/cve/CVE-2026-89897.md) | High | media: cec: Serialize exclusive follower delivery | 7.8 | 0.0031 | | | [CVE-2026-89645](https://patchblox.com/security/data/cve/CVE-2026-89645.md) | High | btrfs: drop recovered reloc root refs on recovery failure | 7.0 | 0.0025 | | | [CVE-2026-93241](https://patchblox.com/security/data/cve/CVE-2026-93241.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dyi... | n/a | 0.0023 | | | [CVE-2026-93240](https://patchblox.com/security/data/cve/CVE-2026-93240.md) | High | memcg: make the v1 soft limit knob inert | 7.8 | 0.0023 | | | [CVE-2026-89694](https://patchblox.com/security/data/cve/CVE-2026-89694.md) | High | nfsd: check client ownership when cancelling a copy-notify stateid | 8.8 | 0.0022 | | | [CVE-2026-93239](https://patchblox.com/security/data/cve/CVE-2026-93239.md) | High | arm64: mm: Fix the lockless page-table walk in show_pte() | 7.8 | 0.0022 | | | [CVE-2026-89984](https://patchblox.com/security/data/cve/CVE-2026-89984.md) | High | perf/x86/intel: Fix kernel address leakages in LBR stack | 7.1 | 0.0022 | | | [CVE-2026-89543](https://patchblox.com/security/data/cve/CVE-2026-89543.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_... | 7.8 | 0.0021 | | | [CVE-2026-89484](https://patchblox.com/security/data/cve/CVE-2026-89484.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocat... | 7.5 | 0.0021 | | | [CVE-2026-89983](https://patchblox.com/security/data/cve/CVE-2026-89983.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i... | 7.0 | 0.0021 | | | [CVE-2026-89451](https://patchblox.com/security/data/cve/CVE-2026-89451.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle... | 7.8 | 0.0021 | | | [CVE-2026-89502](https://patchblox.com/security/data/cve/CVE-2026-89502.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with sub... | 7.8 | 0.0021 | | | [CVE-2026-89701](https://patchblox.com/security/data/cve/CVE-2026-89701.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIME_DELEG decode pat... | n/a | 0.0021 | | | [CVE-2026-89714](https://patchblox.com/security/data/cve/CVE-2026-89714.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation_hash_table leak when nfs4_se... | n/a | 0.0021 | | | [CVE-2026-89991](https://patchblox.com/security/data/cve/CVE-2026-89991.md) | High | bpf: Fix infinite loop in pcpu_freelist push with one possible CPU | n/a | 0.0021 | | | [CVE-2026-80840](https://patchblox.com/security/data/cve/CVE-2026-80840.md) | High | ipv6: seg6: clear IPv4 control block on IPIP decapsulation | 7.8 | 0.0021 | | | [CVE-2026-89556](https://patchblox.com/security/data/cve/CVE-2026-89556.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In... | n/a | 0.0020 | | | [CVE-2026-89577](https://patchblox.com/security/data/cve/CVE-2026-89577.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly... | n/a | 0.0020 | | | [CVE-2026-93244](https://patchblox.com/security/data/cve/CVE-2026-93244.md) | High | drm/sysfb: simpledrm: Improve stride validation | 7.0 | 0.0020 | | | [CVE-2026-89578](https://patchblox.com/security/data/cve/CVE-2026-89578.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying i... | n/a | 0.0020 | | | [CVE-2026-80824](https://patchblox.com/security/data/cve/CVE-2026-80824.md) | High | usb: usbfs: fix use-after-free of usb_device in usbdev_release() | 8.8 | 0.0020 | | | [CVE-2026-90039](https://patchblox.com/security/data/cve/CVE-2026-90039.md) | High | NFSD: Guard admin state-revocation walks with NFSD_NET_UP | 7.8 | 0.0019 | | | [CVE-2026-89930](https://patchblox.com/security/data/cve/CVE-2026-89930.md) | High | KVM: nVMX: Service local TLB flushes on failed nested VM-Enter | 9.3 | 0.0019 | | | [CVE-2026-89913](https://patchblox.com/security/data/cve/CVE-2026-89913.md) | High | KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables | 8.8 | 0.0019 | | | [CVE-2026-89588](https://patchblox.com/security/data/cve/CVE-2026-89588.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length account... | 8.4 | 0.0019 | | | [CVE-2026-89668](https://patchblox.com/security/data/cve/CVE-2026-89668.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsd_debugfs_init() after nfsd4_init_... | 7.8 | 0.0018 | | | [CVE-2026-93227](https://patchblox.com/security/data/cve/CVE-2026-93227.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: deferred_grow_zone(): fix out-of-ran... | n/a | 0.0018 | | | [CVE-2026-80852](https://patchblox.com/security/data/cve/CVE-2026-80852.md) | High | tls: device: fix out-of-bounds write in tls_append_frag() | 7.8 | 0.0018 | | | [CVE-2026-89912](https://patchblox.com/security/data/cve/CVE-2026-89912.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL c... | 7.1 | 0.0018 | | | [CVE-2026-89992](https://patchblox.com/security/data/cve/CVE-2026-89992.md) | High | cpuidle: dt_idle_genpd: kfree() the original name allocation | 8.4 | 0.0018 | | | [CVE-2026-89927](https://patchblox.com/security/data/cve/CVE-2026-89927.md) | High | KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock | 7.8 | 0.0018 | | | [CVE-2026-89638](https://patchblox.com/security/data/cve/CVE-2026-89638.md) | High | smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions | 8.8 | 0.0018 | | | [CVE-2026-81004](https://patchblox.com/security/data/cve/CVE-2026-81004.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error... | 8.4 | 0.0018 | | | [CVE-2026-89693](https://patchblox.com/security/data/cve/CVE-2026-89693.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4_acl_to_attr() return value in... | 9.8 | 0.0018 | | | [CVE-2026-80842](https://patchblox.com/security/data/cve/CVE-2026-80842.md) | High | net: bridge: mcast: fix use-after-free of a master VLAN's multicast context | 7.8 | 0.0018 | | | [CVE-2026-89552](https://patchblox.com/security/data/cve/CVE-2026-89552.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failu... | 7.8 | 0.0018 | | | [CVE-2026-89602](https://patchblox.com/security/data/cve/CVE-2026-89602.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers wh... | 7.8 | 0.0018 | | | [CVE-2026-89799](https://patchblox.com/security/data/cve/CVE-2026-89799.md) | High | bpf: Disable preemption in bpf_get_stackid | 7.8 | 0.0018 | | | [CVE-2026-89618](https://patchblox.com/security/data/cve/CVE-2026-89618.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in... | 7.0 | 0.0018 | | | [CVE-2026-89666](https://patchblox.com/security/data/cve/CVE-2026-89666.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETA... | 9.8 | 0.0017 | | | [CVE-2026-80837](https://patchblox.com/security/data/cve/CVE-2026-80837.md) | High | netfilter: nf_tables: don't queue packet path object notifications | 7.8 | 0.0017 | | | [CVE-2026-80841](https://patchblox.com/security/data/cve/CVE-2026-80841.md) | High | net/packet: defer vmalloc TX_RING free until skbs finish | 7.8 | 0.0017 | | | [CVE-2026-89646](https://patchblox.com/security/data/cve/CVE-2026-89646.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback ab... | 7.8 | 0.0017 | | | [CVE-2026-89767](https://patchblox.com/security/data/cve/CVE-2026-89767.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-m... | 7.8 | 0.0017 | | | [CVE-2026-89710](https://patchblox.com/security/data/cve/CVE-2026-89710.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_lay... | 7.5 | 0.0017 | | | [CVE-2026-93205](https://patchblox.com/security/data/cve/CVE-2026-93205.md) | High | iommu/arm-smmu-v3: Manage teardown with devm | 7.0 | 0.0017 | | | [CVE-2026-90049](https://patchblox.com/security/data/cve/CVE-2026-90049.md) | High | net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() | 9.3 | 0.0017 | | | [CVE-2026-80994](https://patchblox.com/security/data/cve/CVE-2026-80994.md) | High | net: openvswitch: fix flow mask use-after-free on flow deletion | 7.8 | 0.0017 | | | [CVE-2026-89932](https://patchblox.com/security/data/cve/CVE-2026-89932.md) | High | KVM: nVMX: Always flush vpid02 on first use | 9.8 | 0.0017 | | | [CVE-2026-89520](https://patchblox.com/security/data/cve/CVE-2026-89520.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-fl... | 7.8 | 0.0017 | | | [CVE-2026-89557](https://patchblox.com/security/data/cve/CVE-2026-89557.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in sup... | 7.8 | 0.0017 | | | [CVE-2026-89559](https://patchblox.com/security/data/cve/CVE-2026-89559.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __... | 7.8 | 0.0017 | | | [CVE-2026-89574](https://patchblox.com/security/data/cve/CVE-2026-89574.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read... | 7.8 | 0.0017 | | | [CVE-2026-89741](https://patchblox.com/security/data/cve/CVE-2026-89741.md) | High | Revert "media: v4l2-dev: fix error handling in __video_register_device()" | 7.8 | 0.0017 | | | [CVE-2026-89823](https://patchblox.com/security/data/cve/CVE-2026-89823.md) | High | drm: fix race between partial drm_dev_register() failure and ioctl | 7.8 | 0.0017 | | | [CVE-2026-89965](https://patchblox.com/security/data/cve/CVE-2026-89965.md) | High | nvdimm/btt: reject an arena whose nfree is below the lane count | 7.8 | 0.0017 | | | [CVE-2026-89988](https://patchblox.com/security/data/cve/CVE-2026-89988.md) | High | kprobes: Protect kprobe_blacklist with RCU | 7.8 | 0.0017 | | | [CVE-2026-89998](https://patchblox.com/security/data/cve/CVE-2026-89998.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table... | 7.8 | 0.0017 | | | [CVE-2026-89928](https://patchblox.com/security/data/cve/CVE-2026-89928.md) | High | KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk | 8.8 | 0.0017 | | | [CVE-2026-89929](https://patchblox.com/security/data/cve/CVE-2026-89929.md) | High | KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU | 8.8 | 0.0017 | | | [CVE-2026-80838](https://patchblox.com/security/data/cve/CVE-2026-80838.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vxlan: keep the last remote linked during FDB fl... | 7.8 | 0.0017 | | | [CVE-2026-89500](https://patchblox.com/security/data/cve/CVE-2026-89500.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer... | 7.8 | 0.0017 | | | [CVE-2026-89501](https://patchblox.com/security/data/cve/CVE-2026-89501.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing... | 7.8 | 0.0017 | | | [CVE-2026-89503](https://patchblox.com/security/data/cve/CVE-2026-89503.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_bu... | 7.8 | 0.0017 | | | [CVE-2026-93212](https://patchblox.com/security/data/cve/CVE-2026-93212.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsd_serv deref in nfsd_file_net_dis... | 7.5 | 0.0017 | | | [CVE-2026-93230](https://patchblox.com/security/data/cve/CVE-2026-93230.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage... | n/a | 0.0017 | | | [CVE-2026-89579](https://patchblox.com/security/data/cve/CVE-2026-89579.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on... | 7.8 | 0.0017 | | | [CVE-2026-80946](https://patchblox.com/security/data/cve/CVE-2026-80946.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer fo... | n/a | 0.0017 | | | [CVE-2026-89997](https://patchblox.com/security/data/cve/CVE-2026-89997.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issue... | 7.8 | 0.0016 | | | [CVE-2026-89690](https://patchblox.com/security/data/cve/CVE-2026-89690.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_sta... | 8.8 | 0.0016 | | | [CVE-2026-89545](https://patchblox.com/security/data/cve/CVE-2026-89545.md) | High | sunrpc: defer rq_argp and rq_resp free until after RCU grace period | 7.8 | 0.0016 | | | [CVE-2026-89747](https://patchblox.com/security/data/cve/CVE-2026-89747.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read o... | 7.8 | 0.0016 | | | [CVE-2026-89899](https://patchblox.com/security/data/cve/CVE-2026-89899.md) | High | media: cec: disable delayed work before freeing an interrupted transmit | 7.8 | 0.0016 | | | [CVE-2026-89986](https://patchblox.com/security/data/cve/CVE-2026-89986.md) | High | mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() | 7.8 | 0.0016 | | | [CVE-2026-80929](https://patchblox.com/security/data/cve/CVE-2026-80929.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[... | 7.8 | 0.0016 | | | [CVE-2026-89911](https://patchblox.com/security/data/cve/CVE-2026-89911.md) | High | KVM: arm64: Correctly cap TLBI Range to the architural limit | 7.9 | 0.0016 | | | [CVE-2026-80862](https://patchblox.com/security/data/cve/CVE-2026-80862.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of page_frag_cache nvme use... | 9.8 | 0.0016 | | | [CVE-2026-80860](https://patchblox.com/security/data/cve/CVE-2026-80860.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend Aft... | 7.8 | 0.0016 | | | [CVE-2026-80857](https://patchblox.com/security/data/cve/CVE-2026-80857.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR_FINISHED on abort_on_kill to p... | n/a | 0.0016 | | | [CVE-2026-80858](https://patchblox.com/security/data/cve/CVE-2026-80858.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release seman... | n/a | 0.0016 | | | [CVE-2026-80859](https://patchblox.com/security/data/cve/CVE-2026-80859.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: fix missing barrier when checking io-uring... | n/a | 0.0016 | | | [CVE-2026-89615](https://patchblox.com/security/data/cve/CVE-2026-89615.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log rec... | 8.4 | 0.0015 | | | [CVE-2026-89448](https://patchblox.com/security/data/cve/CVE-2026-89448.md) | High | iommu/vt-d: Force requesting ACS when tboot is enabled | 9.3 | 0.0014 | | | [CVE-2026-89744](https://patchblox.com/security/data/cve/CVE-2026-89744.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for... | 8.4 | 0.0014 | | | [CVE-2026-89743](https://patchblox.com/security/data/cve/CVE-2026-89743.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response le... | 7.7 | 0.0014 | | | [CVE-2026-89641](https://patchblox.com/security/data/cve/CVE-2026-89641.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfo_put() in cif... | 7.8 | 0.0014 | | | [CVE-2026-89563](https://patchblox.com/security/data/cve/CVE-2026-89563.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()... | 7.8 | 0.0014 | | | [CVE-2026-89564](https://patchblox.com/security/data/cve/CVE-2026-89564.md) | High | ip: orphan prefetched skbs before multicast forwarding | 7.8 | 0.0014 | | | [CVE-2026-89617](https://patchblox.com/security/data/cve/CVE-2026-89617.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log repla... | 7.8 | 0.0014 | | | [CVE-2026-89754](https://patchblox.com/security/data/cve/CVE-2026-89754.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping wal... | 7.8 | 0.0014 | | | [CVE-2026-80932](https://patchblox.com/security/data/cve/CVE-2026-80932.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order v... | 8.4 | 0.0014 | | | [CVE-2026-89580](https://patchblox.com/security/data/cve/CVE-2026-89580.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in __bpf_get_stack get_... | 7.8 | 0.0013 | | | [CVE-2026-80977](https://patchblox.com/security/data/cve/CVE-2026-80977.md) | High | net: skbuff: don't touch shared zerocopy state in skb_tx_error() | 7.8 | 0.0013 | | | [CVE-2026-80978](https://patchblox.com/security/data/cve/CVE-2026-80978.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunne... | 7.8 | 0.0013 | | | [CVE-2026-89487](https://patchblox.com/security/data/cve/CVE-2026-89487.md) | High | openvswitch: only skb_tx_error() a packet we are about to drop | 7.8 | 0.0013 | | | [CVE-2026-89540](https://patchblox.com/security/data/cve/CVE-2026-89540.md) | High | sunrpc: init gssp_lock before publishing proc entry | 7.8 | 0.0013 | | | [CVE-2026-89562](https://patchblox.com/security/data/cve/CVE-2026-89562.md) | High | ip6_gre: fix hardware header length for NBMA tunnels | 7.8 | 0.0013 | | | [CVE-2026-89573](https://patchblox.com/security/data/cve/CVE-2026-89573.md) | High | dm array: reject an array block whose value size is not the caller's | 7.8 | 0.0013 | | | [CVE-2026-89581](https://patchblox.com/security/data/cve/CVE-2026-89581.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an... | 7.8 | 0.0013 | | | [CVE-2026-89450](https://patchblox.com/security/data/cve/CVE-2026-89450.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than t... | 8.8 | 0.0013 | | | [CVE-2026-81006](https://patchblox.com/security/data/cve/CVE-2026-81006.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration fai... | 7.8 | 0.0013 | | | [CVE-2026-89507](https://patchblox.com/security/data/cve/CVE-2026-89507.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_write_cm_eve... | 7.8 | 0.0013 | | | [CVE-2026-89488](https://patchblox.com/security/data/cve/CVE-2026-89488.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-fre... | 8.8 | 0.0013 | | | [CVE-2026-89560](https://patchblox.com/security/data/cve/CVE-2026-89560.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG fo... | 8.4 | 0.0013 | | | [CVE-2026-89508](https://patchblox.com/security/data/cve/CVE-2026-89508.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path(... | 7.8 | 0.0013 | | | [CVE-2026-89548](https://patchblox.com/security/data/cve/CVE-2026-89548.md) | High | SUNRPC: always drain cache_cleaner before destroying a cache_detail | 7.8 | 0.0013 | | | [CVE-2026-89640](https://patchblox.com/security/data/cve/CVE-2026-89640.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_ra... | 7.1 | 0.0013 | | | [CVE-2026-89691](https://patchblox.com/security/data/cve/CVE-2026-89691.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to pre... | 8.1 | 0.0013 | | | [CVE-2026-89593](https://patchblox.com/security/data/cve/CVE-2026-89593.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmappin... | 7.1 | 0.0013 | | | [CVE-2026-93229](https://patchblox.com/security/data/cve/CVE-2026-93229.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpc_status_get... | 7.1 | 0.0013 | | | [CVE-2026-89486](https://patchblox.com/security/data/cve/CVE-2026-89486.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_de... | 7.8 | 0.0012 | | | [CVE-2026-89600](https://patchblox.com/security/data/cve/CVE-2026-89600.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info... | 7.8 | 0.0012 | | | [CVE-2026-89763](https://patchblox.com/security/data/cve/CVE-2026-89763.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering truste... | 7.8 | 0.0012 | | | [CVE-2026-89771](https://patchblox.com/security/data/cve/CVE-2026-89771.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring bu... | 7.8 | 0.0012 | | | [CVE-2026-63858](https://patchblox.com/security/data/cve/CVE-2026-63858.md) | High | netfilter: nf_tables: add hook transactions for device deletions | 7.8 | 0.0010 | | | [CVE-2026-89603](https://patchblox.com/security/data/cve/CVE-2026-89603.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s... | 9.8 | n/a | | | [CVE-2026-81009](https://patchblox.com/security/data/cve/CVE-2026-81009.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_str... | n/a | n/a | | | [CVE-2026-89575](https://patchblox.com/security/data/cve/CVE-2026-89575.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in bu... | 6.7 | 0.0023 | | | [CVE-2026-90015](https://patchblox.com/security/data/cve/CVE-2026-90015.md) | Routine | xhci: fix lost bounce buffers on TDs spanning several ring segments | 6.5 | 0.0022 | | | [CVE-2026-89816](https://patchblox.com/security/data/cve/CVE-2026-89816.md) | Routine | drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used | 5.5 | 0.0022 | | | [CVE-2026-89595](https://patchblox.com/security/data/cve/CVE-2026-89595.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent... | 3.3 | 0.0022 | | | [CVE-2026-80847](https://patchblox.com/security/data/cve/CVE-2026-80847.md) | Routine | tcp: clamp route advmss to TCP_MIN_MSS | 5.5 | 0.0021 | | | [CVE-2026-89604](https://patchblox.com/security/data/cve/CVE-2026-89604.md) | Routine | efivarfs: Rate limit statfs() handler | 5.5 | 0.0021 | | | [CVE-2026-89822](https://patchblox.com/security/data/cve/CVE-2026-89822.md) | Routine | drm/i915: Guard against NULL driver_data in i915_pci_probe() | 5.5 | 0.0021 | | | [CVE-2026-89989](https://patchblox.com/security/data/cve/CVE-2026-89989.md) | Routine | ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() | 5.5 | 0.0021 | | | [CVE-2026-89539](https://patchblox.com/security/data/cve/CVE-2026-89539.md) | Routine | SUNRPC: reject duplicate CREDS_VALUE options | 4.4 | 0.0021 | | | [CVE-2026-89757](https://patchblox.com/security/data/cve/CVE-2026-89757.md) | Routine | mm/mglru: fix and remove redundant unevictable folio handling | 3.6 | 0.0021 | | | [CVE-2026-89566](https://patchblox.com/security/data/cve/CVE-2026-89566.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy ch... | 5.5 | 0.0021 | | | [CVE-2026-89567](https://patchblox.com/security/data/cve/CVE-2026-89567.md) | Routine | jbd2: bound shrinker scans by examined checkpoint buffers | 5.5 | 0.0021 | | | [CVE-2026-89453](https://patchblox.com/security/data/cve/CVE-2026-89453.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR fau... | 4.4 | 0.0021 | | | [CVE-2026-89698](https://patchblox.com/security/data/cve/CVE-2026-89698.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to so... | 3.3 | 0.0021 | | | [CVE-2026-80755](https://patchblox.com/security/data/cve/CVE-2026-80755.md) | Routine | selinux: reject a permission value exceeding the class permission count | 6.7 | 0.0020 | | | [CVE-2026-89756](https://patchblox.com/security/data/cve/CVE-2026-89756.md) | Routine | mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() | 4.7 | 0.0020 | | | [CVE-2026-80830](https://patchblox.com/security/data/cve/CVE-2026-80830.md) | Routine | usb: core: Add lock to usb_wakeup_notification() | 6.6 | 0.0020 | | | [CVE-2026-80843](https://patchblox.com/security/data/cve/CVE-2026-80843.md) | Routine | xfrm: fix xfrm_state_construct() auth-trunc leak | 4.4 | 0.0020 | | | [CVE-2026-89766](https://patchblox.com/security/data/cve/CVE-2026-89766.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec_update_lock around namespace io... | 4.4 | 0.0019 | | | [CVE-2026-89768](https://patchblox.com/security/data/cve/CVE-2026-89768.md) | Routine | fs: fix user path of nested backing files | 3.3 | 0.0019 | | | [CVE-2026-93206](https://patchblox.com/security/data/cve/CVE-2026-93206.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use file_ns_capable() when checking co... | 3.4 | 0.0019 | | | [CVE-2026-89525](https://patchblox.com/security/data/cve/CVE-2026-89525.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count... | 6.7 | 0.0018 | | | [CVE-2026-80855](https://patchblox.com/security/data/cve/CVE-2026-80855.md) | Routine | fuse: fix invalidate lock leak on open O_TRUNC DAX failure | 4.7 | 0.0018 | | | [CVE-2026-80856](https://patchblox.com/security/data/cve/CVE-2026-80856.md) | Routine | fuse: fix invalidate lock leak on setattr writeback failure | 4.7 | 0.0018 | | | [CVE-2026-80861](https://patchblox.com/security/data/cve/CVE-2026-80861.md) | Routine | usb: xhci: bail out of setup if the controller is inaccessible | 4.7 | 0.0018 | | | [CVE-2026-80963](https://patchblox.com/security/data/cve/CVE-2026-80963.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu d... | 5.5 | 0.0018 | | | [CVE-2026-81005](https://patchblox.com/security/data/cve/CVE-2026-81005.md) | Routine | ipmi: si: Fix NULL pointer dereference after failed registration | 5.5 | 0.0018 | | | [CVE-2026-89753](https://patchblox.com/security/data/cve/CVE-2026-89753.md) | Routine | mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() | 4.7 | 0.0018 | | | [CVE-2026-89726](https://patchblox.com/security/data/cve/CVE-2026-89726.md) | Routine | lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() | 4.4 | 0.0018 | | | [CVE-2026-93222](https://patchblox.com/security/data/cve/CVE-2026-93222.md) | Routine | signal: avoid shared siginfo namespace rewrites | 4.4 | 0.0018 | | | [CVE-2026-93226](https://patchblox.com/security/data/cve/CVE-2026-93226.md) | Routine | ipv6: use RCU iterator to dump route exceptions | 4.2 | 0.0018 | | | [CVE-2026-89752](https://patchblox.com/security/data/cve/CVE-2026-89752.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is s... | 3.4 | 0.0018 | | | [CVE-2026-93231](https://patchblox.com/security/data/cve/CVE-2026-93231.md) | Routine | lockd: fix swapped arguments in nlmsvc_match_ip() | 3.4 | 0.0018 | | | [CVE-2026-89515](https://patchblox.com/security/data/cve/CVE-2026-89515.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_al... | 3.3 | 0.0018 | | | [CVE-2026-93213](https://patchblox.com/security/data/cve/CVE-2026-93213.md) | Routine | of: fix out-of-bounds read in of_alias_scan() stem parser | 3.0 | 0.0018 | | | [CVE-2026-89683](https://patchblox.com/security/data/cve/CVE-2026-89683.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export fileh... | 6.5 | 0.0018 | | | [CVE-2026-89589](https://patchblox.com/security/data/cve/CVE-2026-89589.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use raw_spinlock_t for CXL CPER... | 4.7 | 0.0018 | | | [CVE-2026-93210](https://patchblox.com/security/data/cve/CVE-2026-93210.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid ta... | 5.5 | 0.0017 | | | [CVE-2026-89565](https://patchblox.com/security/data/cve/CVE-2026-89565.md) | Routine | ipip: fix skb leak in collect_md mode when metadata_dst allocation fails | 3.7 | 0.0017 | | | [CVE-2026-89644](https://patchblox.com/security/data/cve/CVE-2026-89644.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O w... | 3.3 | 0.0017 | | | [CVE-2026-80845](https://patchblox.com/security/data/cve/CVE-2026-80845.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work... | 5.5 | 0.0017 | | | [CVE-2026-89717](https://patchblox.com/security/data/cve/CVE-2026-89717.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram_des... | 5.5 | 0.0017 | | | [CVE-2026-93211](https://patchblox.com/security/data/cve/CVE-2026-93211.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registeri... | 4.4 | 0.0017 | | | [CVE-2026-89700](https://patchblox.com/security/data/cve/CVE-2026-89700.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in lis... | 3.3 | 0.0017 | | | [CVE-2026-80920](https://patchblox.com/security/data/cve/CVE-2026-80920.md) | Routine | io_uring: defer eventfd signaling when queued from a wakeup handler | 3.3 | 0.0017 | | | [CVE-2026-80925](https://patchblox.com/security/data/cve/CVE-2026-80925.md) | Routine | vlan: fix skb_under_panic and races when toggling HW VLAN offload | 5.5 | 0.0016 | | | [CVE-2026-98164](https://patchblox.com/security/data/cve/CVE-2026-98164.md) | Routine | KVM: x86/mmu: Check write tracking in all address spaces | 5.5 | 0.0015 | | --- Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.